Hello GrayLog Experts,
I am using docker for GrayLog as follows:
I have an index retention config for 3 GB per index up to a total of 20 indices. My retention strategy is to Delete the Index. But for some reason, the indices do not delete even though the GRayLog UI indices shows it only has the last 20 indices. Disk space rapidly reaches 100% usage on a 500GB disk. However, when I stop the grayLog and elastic docker containers, disk space is released and then disk usage returns to 10% from 100%. It is almost like the indices are not deleted until I stop the docker container.
Any ideas on how to handle this? I use the following docker run commands to mount the file on the host system:
docker run --name mongo
docker run --name elasticsearch
-e “http.host=0.0.0.0” -e “xpack.security.enabled=false”
docker run --link mongo --link elasticsearch --name graylog
-p 9000:9000 -p xxxx:xxxx -p xxxx:xxx/udp -p xxx:xx
The file that is consuming all disk space is /var/lib/containers//.json
Why is this file not getting purged with the retention strategy?